Etherpad is a popular collaborative real-time editing application. It is written to run within the NodeJS server-side JavaScript engine.

A lot of its code is quite old and written using coding paradigms that have since been replaced with much better alternatives. This resulted in a significant “technical debt” and a code base that is difficult to maintain and enhance.

At ISC we use Etherpad extensively. We wanted to add some functionality but found the code base very difficult to work with, and in particular the program’s flow of execution was difficult to analyse. I determined that the code could probably benefit from rewriting parts of it to take advantage of new language features.

With ISC’s support, I therefore recently spent a few weeks working on a significant refactoring of the Etherpad code, with that work described here.

This release fixes several security vulnerabilities in recent versions:

One is an arbitrary code execution vulnerability in version 1.6.3.

Another is an arbitrary code execution vulnerability which is present in all versions from 1.5.0 on, but only exploitable on sites that store pads in DirtyDB, CouchDB, MongoDB, or RethinkDB.

A third allows attackers to export any pad without knowing its name (as normally required) in all versions from 1.5.0 on.

The Etherpad Leadership Team recommends that administrators upgrade to 1.6.4 as soon as possible to mitigate these issues.

“Etherpad is key to a number of organization that promote collaboration, freedom and transparency and as such we are proud to provide infrastructure for these values,”

said John McLear, Etherpad’s chief maintainer.

“In a world that is becoming more fragmented, we’re very keen to promote global collaboration and are dedicated to improving the security of Etherpad.”

About Etherpad

Etherpad is a highly customizable free software editor for collaborative editing online. Used to support collaboration across many important initiatives across the Internet, Etherpad is critical web infrastructure. Etherpad is widely used by individuals and groups who want to collaborate effectively using decentralized trusted free software.

TLDR; Etherpad has changed a lot over the last few years, you should check out some of the great new stuff.

There has been a lot of progress in Etherpad but you might not know about it all because the instance you are using might be old and out of date. We wanted to make it easy for you so here is what’s new in Etherpad since we went open source nearly 5 years ago!

Accessibility

From High Resolution screen support to screen reader support to Internationalization (Translations) to Keyboard shortcuts we’re really keen to improve accessibility on the front end. On the back end various well documented clients and libraries for both the API and editor all supported by excellent Etherpad core documentation. We have also focused on document portability ensuring your ENTIRE pad including every single edit(and it’s history) can be exported and taken from one Etherpad instance to another, something no competitor offers.

Huge performance increases

The “old” version of Etherpad was stable up to about 20 people on a pad, after that things got a bit shaky. We’re now testing up to about 250 users on a single pad, way beyond what competitors can offer.

Stability improvements

We now provide both automated front-end and automated back-end testing for Etherpad. This has helped uptime instances be way within the 99.9% threshold required by most operators. While we’re constantly improving on this we’re really proud of the latest figures (99.993% up-time) across our enterprise supported instances and we hope to keep pushing for even better stability moving forward.

Recently we began providing our security releases as CVEs, this has helped the security community do deeper audits of Etherpad to move forward to a more secure piece of software

Commercial services

You know what commercial services are, if your company is using Etherpad then you probably have an internal guy that’s your Etherpad guy. Without that guy we wouldn’t exist as a project so here is an opportunity for us to say thanks! If you are that guy and you feel like you would like some support with your Etherpad instance do get in touch and we’d be happy to connect you to someone that can help. If you are a developer or admin and enjoy working with Etherpad then also get in touch, we can connect those dots too!

This is another security release, the exploit is documented as CVE-2015-3297 — If a specifically formatted URL is used to access Etherpad a file can be read from the filesystem. This issue has existed in Etherpad since 2012 so pretty much all deployments will be effected.

We have been doing a lot of security releases lately as we complete our third security audit. Our apologies for creating such a fire under admins to update so frequently lately.

SECURITY: Traversing URL exploit
NEW: Default Pad options can now be defined in settings.json, see the Etherpad Template file for reference.
NEW: sessionKey is now automatically generated and stored in the file system.
NEW: Logic for handling pad creation with illegal characters
FIX: IE10 now works
FIX: html10n missing semicolons, prevents warnings
FIX: Importing of Large .Etherpad files no longer crashes the server
UPDATES: Update all stuck dependencies (Inc underscore)
UPDATES: Update to Express 4
UPDATES: We no longer support IE8

I spotted something that’s wrong or I think it can be made better, how can I tell you?

When will see accessibility land in a major release?

We’re hours away from starting our 2015 hackathon which should bare the fruits of a major release so hopefully a major release will land within 48 hours of this blog post however if you are itching to get your mitts on Accessibility features simply checkout the Etherpad develop branch.

Nginx by Default with Etherpad will display the Nginx Server name value and not forward the Etherpad Server name value. This is a problem as it means your Etherpad version is not available in the Headers which makes debug more difficult among other things.

To solve this add the below your Nginx config and you are done :)
proxy_pass_header Server;